npmPackage

@fastify/reply-from

3 known vulnerabilities (1 critical, 2 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-33805Critical 9.0
@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers
Affected: fixed in 12.6.2.
Fixed in 12.6.2 (released Apr 15, 2026, the day of disclosure).
The latest release, 12.8.1, is not affected.
22% of @fastify/reply-from downloads last week were affected versions (182.1K).
CVE-2025-66415Medium 6.9
fastify-reply-from bypass of reply forwarding
Affected: fixed in 12.5.0.
Fixed in 12.5.0 (released Dec 1, 2025, the day of disclosure).
The latest release, 12.8.1, is not affected.
17% of @fastify/reply-from downloads last week were affected versions (145.5K).
CVE-2023-51701Medium 5.3
@fastify-reply-from JSON Content-Type parsing confusion
Affected: fixed in 9.6.0.
Fixed in 9.6.0 (released Jan 8, 2024, the day of disclosure).
The latest release, 12.8.1, is not affected.
2.6% of @fastify/reply-from downloads last week were affected versions (22.2K).